Difference between revisions of "Main Page"

From Forensics Wiki
Jump to: navigation, search
m
m (WIKI NEWS)
(17 intermediate revisions by 3 users not shown)
Line 2: Line 2:
 
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 
    
 
    
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
+
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[Upcoming_events|conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
 
</div>   
 
</div>   
  
<b>WIKI MAINTENANCE NOTE: We have re-installed mediawiki. New anti-spam measures and account re-confirmation software is in effect. Please let us know if you have problems on the [[Contact Form]]</b>
 
  
 +
==WIKI NEWS==
 +
2013-MAR-18: We have moved to a new server on hostgator and upgraded the mediawiki installation. All accounts and images have been restored from backups. There may be some hiccups, but it seems to be working.
  
 
{| width="100%"
 
{| width="100%"
Line 15: Line 16:
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
  
<small>August 2011</small>
+
<small>Jan 2013</small>
 
+
 
<bibtex>
 
<bibtex>
@article{beverly:ipcarving,
+
@article{young:distinct,
  author = "Robert Beverly and Simson Garfinkel and Gregory Cardwell",
+
  title="Distinct Sector hashing for Target Detection",
  journal = "Digital Investigation",
+
  author="Joel Young and Kristina Foster and Simson Garfinkel and Kevin Fairbanks",
  publisher="Elsevier",
+
  year=2012,
  booktitle = {Proc. of the Eleventh Annual DFRWS Conference},
+
  month=Dec,
  title = "Forensic Carving of Network Packets and Associated Data Structures",
+
  journal="IEEE Computer"
volume=8
+
year = 2011,
+
abstract="Using validated carving techniques, we show that popular operating systems (\eg Windows, Linux, and OSX)  frequently have residual IP packets, Ethernet frames,  and associated data structures present in system memory  from long-terminated network traffic. Such information is useful  for many forensic purposes including establishment of  prior connection activity and services used;  identification of other  systems present on the system's LAN or WLAN; geolocation of the  host computer system; and cross-drive analysis. We show that network structures can also be  recovered from memory that is persisted onto a mass storage medium  during the course of system swapping or hibernation.  We present our network carving techniques, algorithms and tools,  and validate these against both purpose-built memory images and a readily  available forensic corpora.  These techniques are  valuable to both forensics tasks, particularly  in analyzing mobile devices, and to cyber-security objectives such  as malware analysis."
+
 
}
 
}
 
</bibtex>
 
</bibtex>
<i>Using validated carving techniques, we show that popular operating systems (\eg Windows, Linux, and OSX)  frequently have residual IP packets, Ethernet frames,  and associated data structures present in system memory  from long-terminated network traffic. Such information is useful  for many forensic purposes including establishment of  prior connection activity and services used;  identification of other  systems present on the system's LAN or WLAN; geolocation of the  host computer system; and cross-drive analysis. We show that network structures can also be  recovered from memory that is persisted onto a mass storage medium  during the course of system swapping or hibernation.  We present our network carving techniques, algorithms and tools,  and validate these against both purpose-built memory images and a readily  available forensic corpora.  These techniques are  valuable to both forensics tasks, particularly  in analyzing mobile devices, and to cyber-security objectives such  as malware analysis.</i>
+
Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.
 
+
 
+
  
 
(See also [[Past Selected Articles]])
 
(See also [[Past Selected Articles]])

Revision as of 06:17, 19 March 2013

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 686 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2013-MAR-18: We have moved to a new server on hostgator and upgraded the mediawiki installation. All accounts and images have been restored from backups. There may be some hiccups, but it seems to be working.

Featured Forensic Research

Jan 2013

Joel Young, Kristina Foster, Simson Garfinkel, Kevin Fairbanks - Distinct Sector hashing for Target Detection
IEEE Computer , December 2012
Bibtex
Author : Joel Young, Kristina Foster, Simson Garfinkel, Kevin Fairbanks
Title : Distinct Sector hashing for Target Detection
In : IEEE Computer -
Address :
Date : December 2012

Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics



You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.